I think organisations forcing people to change passwords causes greater security risks. For example - if you have a bunch password character and length requirem

I think organisations forcing people to change passwords causes greater security risks. For example - if you have a bunch password character and length requirement, you will find people writing their passwords on paper or being more flexible in storing them. Because of this frequency, people will forget their password often and require assistance of IT admins or other people often through phones and emails. I would say, strong password is slowly becoming a myth due to organizations failing understand what it is before creating a policy surrounding it.